Loading story…
Microsoft and Sophos reported separate but closely aligned social-engineering campaigns in which attackers impersonated IT support staff over Microsoft Teams, phone calls, and related pretexts to trick employees into granting remote access through Quick Assist or other support tools. Microsoft attributed its activity to Storm-1811, which used vishing and email-bombing to gain access, steal credentials through EvilProxy, and deploy tools including Qakbot, Cobalt Strike, ScreenConnect, NetSupport Manager, OpenSSH tunneling, and SystemBC before rolling out Black Basta ransomware with PsExec. Microsoft said it suspended malicious Teams accounts and tenants involved in the impersonation activity and added stronger Quick Assist warnings and trust indicators.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft said it suspended malicious Teams accounts and tenants involved in the impersonation activity and was improving Quick Assist warnings and trust transparency in response to the campaign.
Sophos observed that at least three STAC4749 intrusions culminated in Chaos ransomware deployment, including one case that progressed from initial access to encryption in under 17 hours.
Sophos reported that a Microsoft Teams voice phishing campaign tracked as STAC4749 targeted dozens of organizations in Canada and the United States between February and June 2026 by impersonating IT support staff and persuading users to grant remote access.
By late May 2024, Storm-1811 had expanded its social engineering activity to Microsoft Teams messages and calls impersonating help desk or IT staff to trick users into granting remote access.
Microsoft Threat Intelligence reported that the financially motivated group Storm-1811 had been abusing Quick Assist since mid-April 2024 as part of intrusion chains that led to credential theft, malware delivery, and follow-on Black Basta ransomware activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcesophos.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026
Sophos MDR reported two ransomware campaigns that combined **email bombing** with **voice phishing over Microsoft Teams** to gain initial access to targeted organizations. In the observed intrusions, attackers overwhelmed users with large volumes of emails and then contacted them through Teams while impersonating IT or help desk staff, using the confusion to persuade victims to grant remote access or follow attacker-directed steps. The activity highlights how adversaries are blending social engineering with trusted enterprise collaboration tools to bypass technical defenses. The campaigns were tied to ransomware operations and show a repeatable intrusion pattern in which attackers exploit user fatigue, trust in internal support workflows, and the widespread use of Microsoft 365 services. The reported tradecraft underscores the need for organizations to harden Teams and remote-support processes, verify help desk interactions through separate channels, and train staff to treat unsolicited support calls during email floods as suspicious, especially when they involve requests for remote access, credential entry, or security tool changes.
Jul 12, 2026
A social-engineering campaign targeting employees at **financial and healthcare** organizations is abusing **Microsoft Teams** chats/calls to trick users into granting remote access via *Windows Quick Assist*, enabling deployment of a newly identified malware family dubbed **A0Backdoor**. The activity begins with **email bombing** (flooding inboxes with spam) followed by an attacker impersonating internal IT over Teams, offering help and then persuading the victim to start a Quick Assist session; the tradecraft overlaps with tactics previously attributed to **Blitz Brigantine / Storm-1811**, which Microsoft has linked to **Black Basta**-associated operations. Post-access, the actor deploys **digitally signed MSI installers** masquerading as Teams-related components and *CrossDeviceService* (associated with Windows *Phone Link*), sometimes delivered via **tokenized links** from Microsoft personal cloud storage to appear trustworthy and hinder collection. BlueVoyant reported the installers drop files into user `AppData` paths that mimic legitimate Microsoft locations and use **DLL sideloading** (e.g., a malicious `hostfxr.dll`) to execute an in-memory loader that decrypts shellcode, performs sandbox checks, and ultimately extracts and runs **A0Backdoor** (using **AES**-encrypted payloads and a **SHA-256**-derived key), with anti-analysis behavior including excessive thread creation intended to disrupt debugging.
Jun 29, 2026